Analysis

  • max time kernel
    141s
  • max time network
    69s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15-06-2024 11:31

General

  • Target

    fffdf1835d7392c5219e52210e1defe69baaa05ea052e0e64e01fb6711ca4c6a.exe

  • Size

    627KB

  • MD5

    9e0f6f1ece6e43a25fca63d2feed8cfe

  • SHA1

    c2793e586ee1168e53ae005969213e69da61737c

  • SHA256

    fffdf1835d7392c5219e52210e1defe69baaa05ea052e0e64e01fb6711ca4c6a

  • SHA512

    e74d54f851c0a092a630038a947f6866499d551d7468599864ab700fc0678ac1b29bb15b902d2ba9fc66dee3423bd11ffb38bb2f2f0b62e5a0e48a36ebd4d0c8

  • SSDEEP

    12288:AlnXIR9D+nC8pqwRmMdUL0c77eyeH+2HcSfEY3DAshOTT+ZcOgKS/s:Am0C84wRmMaL0xrX8Sfd5sTPOhSk

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fffdf1835d7392c5219e52210e1defe69baaa05ea052e0e64e01fb6711ca4c6a.exe
    "C:\Users\Admin\AppData\Local\Temp\fffdf1835d7392c5219e52210e1defe69baaa05ea052e0e64e01fb6711ca4c6a.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:1888

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1888-1-0x0000000000560000-0x0000000000660000-memory.dmp
    Filesize

    1024KB

  • memory/1888-2-0x00000000021D0000-0x000000000223B000-memory.dmp
    Filesize

    428KB

  • memory/1888-3-0x0000000000400000-0x000000000046F000-memory.dmp
    Filesize

    444KB

  • memory/1888-4-0x0000000000400000-0x00000000004AC000-memory.dmp
    Filesize

    688KB

  • memory/1888-5-0x0000000000400000-0x00000000004AC000-memory.dmp
    Filesize

    688KB

  • memory/1888-7-0x0000000000560000-0x0000000000660000-memory.dmp
    Filesize

    1024KB

  • memory/1888-8-0x00000000021D0000-0x000000000223B000-memory.dmp
    Filesize

    428KB

  • memory/1888-9-0x0000000000400000-0x000000000046F000-memory.dmp
    Filesize

    444KB